MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f01a0a5f00d76ff678ced69113e440e0f1935839530bb0fa197a2775a4c2c52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f01a0a5f00d76ff678ced69113e440e0f1935839530bb0fa197a2775a4c2c52
SHA3-384 hash: 9b841a270feb52aa01d2f0c7a0b2579e2429208d4092244acecfb86f94619024a1446d7d46db12eee95f5c5bd77bf6de
SHA1 hash: 39b0f27bcd8b96dca23ac26b53fcfccf800bd341
MD5 hash: fe394a57f8335a0a472a7e1ace15f239
humanhash: enemy-artist-pluto-minnesota
File name:Signed Copy Invoice_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:364'655 bytes
First seen:2020-12-09 11:03:50 UTC
Last seen:2020-12-09 11:09:16 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:Y1Qw4x/lDIRUd6HEymklsLnVgyJb/PA++HtkGWMpwM8o:+Qw4hlD5KyklsjVhljq++
TLSH 4E74234DD889C4ECFD52FA22F96BEF36DC77902841B442D2E0245568AF4CC962B71CA7
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: speckimoveis.com.br
Sending IP: 172.93.201.144
From: soraia@speckimoveis.com.br
Subject: Signed Contract Copy
Attachment: Signed Copy Invoice_pdf.zip (contains "Signed Copy Invoice_pdf.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts14.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f01a0a5f00d76ff678ced69113e440e0f1935839530bb0fa197a2775a4c2c52/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 11:04:15 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4a2bjpqbv3p6z4m5vurcpsebyhrsnmdsuylwd5bs6rhowsmfrja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f01a0a5f00d76ff678ced69113e440e0f1935839530bb0fa197a2775a4c2c52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4f01a0a5f00d76ff678ced69113e440e0f1935839530bb0fa197a2775a4c2c52

(this sample)

AgentTesla

Executable exe f86ae16804864eba0e062dd196a0b46689854fd71b966a5f5ee1621516806379

  
Dropping
MD5 9a6a2ec73e6c92493234c1ebd1e27931
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f86ae16804864eba0e062dd196a0b46689854fd71b966a5f5ee1621516806379

Comments